What is the Backend-for-Frontend (BFF) pattern?
Quick Answer
A BFF is a dedicated backend API built for one specific frontend (the web SPA, the mobile app), rather than one general-purpose API for all clients. It aggregates calls to downstream services, shapes responses exactly for that UI, and — importantly for SPAs — keeps auth tokens server-side in a secure cookie instead of in the browser.
Instead of one API that every client shares, a BFF is a backend built specifically for one frontend. It sits between that frontend and the downstream services, aggregates several calls into one, and returns exactly the shape that UI needs so the client isn't doing five round trips or over-fetching. The big security benefit for a SPA is token handling — the browser only talks to the BFF with a session cookie, and the BFF holds the OAuth tokens and calls the real APIs, so the tokens never touch JavaScript and XSS can't steal them. The cost is another service to deploy per frontend, and you have to keep it thin.
- Why: a mobile app and a rich web app want different data shapes and different chattiness; a shared API compromises both.
- Security win: the SPA talks only to its BFF with a cookie; the BFF holds the OAuth tokens and calls the real APIs. Tokens never reach JavaScript, so XSS can't steal them.
- Downside: another deployable per frontend; risk of business logic leaking into the BFF (keep it thin — aggregation and shaping only).
- Related to but narrower than an API gateway (which is one entry point for everything).